Per the abstract, it sounds like they just... scraped a bunch of email addresses out of the commits in a tree? Is that newsworthy? There's one sentence in there about "targetted phishing attacks", but nothing to back it up.
Please someone tell me this is more than just email address harvesting?
Please someone tell me this is more than just email address harvesting?